What security property does the 'Secure' attribute of a cookie provide, and what attack does it not protect against?

• A.Secure ensures the cookie is only transmitted over HTTPS - preventing interception by passive network observers. It does NOT protect against: XSS (JavaScript can still read it unless HttpOnly is also set), cookie theft via malware on the client, server-side data breaches, or an active MITM who can set cookies via an HTTP sub-resource on a mixed-content page
• B.Secure prevents all JavaScript from reading the cookie, similar to HttpOnly
• C.Secure encrypts the cookie value so even if transmitted, it cannot be read
• D.Secure prevents the cookie from being accessed by subdomains on the same parent domain